During a security audit which test should result in a source packet failing to reach its intended destination?

A fundamental security principle for any network perimeter is the "default-deny" or "least privilege" posture. This means that all unsolicited inbound traffic originating from an untrusted network, such as the Internet, should be blocked by the firewall. A new connection request from the Internet to a standard host on the internal network is the classic example of such unsolicited traffic. A security audit test that simulates this scenario should be blocked by the firewall, thus failing to reach its destination and validating the effectiveness of this critical security control.

B. While traffic from the DMZ to the internal network is heavily restricted, specific, pre-approved connections (e.g., from a web server to a database server) are often permitted, so failure is not guaranteed.
C. A company's public DNS server is, by design, intended to be reachable from the Internet to resolve domain names for external clients; this connection test should succeed.
D. Internal network hosts must be able to communicate with the company's DNS server for name resolution, so this packet should be allowed to reach its destination.

1. National Institute of Standards and Technology (NIST) Special Publication 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy.

Section 3.1, "Firewall Policy," Page 11: States, "A firewall policy should be based on a 'deny-all' or 'default-deny' principle, which means that any traffic not explicitly permitted is denied." This directly supports the rationale for blocking the traffic described in option A.

Section 4.2.1, "Packet Filtering," Page 16: Describes the basic function of blocking traffic from untrusted external sources (the Internet) to internal destinations, which is the scenario in option A.

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson.

Chapter 8.6.2, "Firewalls," Pages 748-750: Explains that a fundamental rule for firewalls is to prevent external clients from initiating TCP connections with internal clients. This is precisely the action described in option A, which should be blocked.

3. MIT OpenCourseWare. (2017). 6.857 Computer and Network Security, Fall 2017. Massachusetts Institute of Technology.

Lecture 15: Network Security I, Firewall Design: The lecture notes describe the standard firewall model where the default policy is to block all inbound connections initiated from the untrusted external network to the trusted internal network. This validates that the test in option A should fail.